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A basic goal in distributed computing is to achieve 
coordination despite the failure of some of the distributed 
processes. This requires the nonfaulty components to 
reach an agreement. The problem of coping with such 
tasks is expressed abstractly as the Byzantine Generals 
Problem, also called Byzantine Agreement (BA) 0, Q ■ 

Three divisions of the Byzantine army, each com- 
manded by its own general, are besieging an enemy city. 
The three generals A, B, and C can communicate with 
one another by messengers only (i.e., by pairwise authen- 
ticated error- free classical channels). They must decide 
upon a common plan of action either or 1 (for instance, 
attack or retreat). The commanding general A decides 
on a plan and communicates this plan to the other two 
generals by sending B a message itlab (either or 1), 
and by sending C a message tuac- Then, B communi- 
cates the plan to C by sending him a message to_bC; and 
C communicates the plan to B by sending him a message 
mcB- However, one of the generals (including A) might 
be a traitor, trying to keep the loyal generals from agree- 
ing on a plan. The BA problem is to devise a protocol 
in which (i) all loyal generals follow the same plan, and 
(ii) if A is loyal, then every loyal general follows the plan 
decided by A. From the point of view of a loyal C receiv- 
ing different messages from A and B, the BA problem is 
equivalent to the liar detection problem H, in which C's 
task is to ascertain who is lying, A or B. 

The BA problem has been proven to be unsolvable 
0, Q , unless each of the generals is in possession of a list 
of numbers unknown to the other generals, but suitably 
correlated with the lists of the other generals. There- 
fore, solving the BA problem can be reduced to solving 
the problem of the generation and secure distribution of 
these lists. A quantum protocol enables one to test the 
security of the distribution, however, in case of an attack, 
no secret lists are available and the whole communication 
has to be aborted. Still, in this case, a variation of the 
BA, called detectable Byzantine agreement (DBA) or de- 
tectable broadcast [H can be solved Q • In the DBA prob- 



lem, conditions (i) and (ii) are relaxed so that (i') either 
all loyal generals perform the same action or all abort, 
and (ii') if A is loyal, then either every loyal general obeys 
the order sent by A or aborts. Consequently, we can de- 
fine a protocol for solving the detectable liar detection 
problem as that one in which the possible outcomes for 
a loyal C receiving different messages from A and B are 
either to detect who is lying or to abort d, d, @] . 

The properties of two specific entangled states have 
suggested two different methods for solving the DBA 
problem. The first method was inspired by the prop- 
erties of the three-qutrit singlet state, and it is based on 
lists of six combinations of numbers Such lists can 
also be distributed using two quantum key distribution 
protocols 0]. The second method was suggested by the 
properties of a four-qubit entangled state, and it is based 
on lists of four combinations of numbers Q . 

In this Letter we introduce a new protocol for solving 
the DBA problem. It uses simpler lists than those in 
0, 0], and uses them more efficiently than in Q. In 
contrast to Q, it allows the simultaneous generation of 
all lists. In addition, we present the first experimental 
demonstration of a quantum protocol for DBA and liar 
detection via four-photon entanglement. 

The protocol has two parts. The goal of the first part 
is to generate and distribute three lists, Ia for A, Ib for 
B, and lc for C utilizing the characteristic properties 
of a particular four-photon polarization entangled state 
H>lli EH; and to check for the security of this distribution. 
Once the parties have these lists, in the second part of the 
protocol they use them, together with pairwise classical 
communication, for reaching the agreement (Fig. [I]). The 
option to abort will be used only in the distribution part. 
Thereafter, the protocol enables full BA. 

In detail.the lists I a, Ib, and lc have the following 
properties [6j]: (I) The three lists have the same length 
L. The elements of I a are random trits (i.e., 0, 1, or 2). 
The elements of Ib and lc are random bits (i.e., or 1). 
(II) At position j in these lists, we find the combinations 
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FIG. 1: Quantum protocol for detectable Byzantine agree- 
ment. Three generals, A (the commanding general), B, and 
C, are connected by pairwise authenticated error-free classi- 
cal channels. In the first part of the protocol, four qubits 
prepared in the state |^' 4 ^) are distributed among the par- 
ties and, after a classical discussion, either (a) each general 
obtains a list U, or (b) all loyal generals agree to abort. If 
(a) then, in the second part of the protocol, A sends B (C) a 
message ttlab (ttiac) and a list Iab (Iac), and B (C) sends 
C (B) a message wise (tticb) and a list Ibc {Igb)- 

000 (i.e., Iaj = 0, Isj = 0, Icj — 0), 111, or, with equal 
probability, either 201 or 210. (Ill) Each party cannot 
know other parties' lists beyond what can be inferred 
from his own list and properties (I) and (II). 

The result of this first part can be that (a) all parties 
agree that they have the right lists and can start the 
second part of the protocol or (b) agree to abort it. 

To simplify the discussion of the second part of the 
protocol, note that the roles of B and C are symmetri- 
cal, and thus everything we say about B applies to C 
and vice versa. The agreement part runs as follows: (i) 
When A sends ttlab, this message must be accompanied 
by other data which must be correlated with the message 
itself and, at the same time, must be known only by A. 
For that purpose, A also sends B a list Iab with all the 
positions in Ia in which the value itiab appears. After 
that, if A is loyal he will follow his own plan. 

Example: if A is loyal, the message is vtiab — ttlac — 
0, and A's list is l A = {2, 0, 0, 2, 1, 1, 0, 0,2,.. .}, then A 
must also send Iab = Iac — {2, 3, 7, 8, . . .}. 

When B receives vtiab and Iab , only one of two things 
can happen: (ia) If Iab is of the appropriate length [i.e., 
approximately L/3, according to property (I)], and itiab, 
Iab, and Ib do satisfy (II), then we will say that the 
data (i.e., ttlab, Iab, and Is) are consistent. If the data 
are consistent, then B will follow the plan vtiab unless 
C convinces him that A is the traitor in the next step 
of the protocol [see (ii)]. (ib) If vtiab, Iab, and Ib are 
inconsistent, then B ascertains that A is the traitor, and 
B will not follow any plan until he reaches an agreement 
with C in the next step of the protocol [see (ii)] . 



Example: B would receive inconsistent data if he 
receives the message vtiab = accompanied by the 
list Iab = {2,5,6,7,...}, and B's list is Ib — 
{1,0,0,0,1,1,0,0,0,...}. This data is inconsistent be- 
cause Ia cannot have at positions 5 and 6. 

(ii) The message vtibc can be not only or 1, but 
also _L, meaning "I have received inconsistent data." If 
the message is or 1, it must be accompanied by other 
data which prove that vtibc is the same one that B has 
received from A] i.e., data that B could only have ob- 
tained from A if vtlbc = itiab- For that purpose, B also 
sends C a list Ibc which is supposedly the same list Iab 
that B has received from A. 

When C receives vtlbc and Ibc, he already has rriAC 
and Iac- Then, only one of six things can happen: (iia) 
If w ac , Iac, and lc are consistent, and ttibc, Ibc, and 
lc are also consistent, and tiiac = ttibc, then C will 
follow the plan vtlac — ttibc- (iib) If vtlac, Iac, and lc 
are consistent, and vase, Ibc, and lc are also consistent, 
but C is receiving conflicting messages (0 or 1) from A 
and B, then C ascertains that A is the traitor and B is 
loyal, since A is the only one who can send consistent 
data to B and C. Since the roles of B and C are sym- 
metrical, B also ascertains that A is the traitor and C 
is loyal. Then C and B will follow a previously decided 
plan, for instance, 0. (he) If vtiac, ^ac, and lc are consis- 
tent, and C is receiving itibc = -L, then C will follow the 
plan vtlac- Note that in this case there is no way for B 
to convince C that he has actually received inconsistent 
information from A. Therefore, following the plan vtlac 
(even if A is the traitor) is the only option for reaching 
agreement with the other loyal party, (iid) If vtlac, ^ac, 
and lc are consistent, but vtlbc, Ibc, and lc are incon- 
sistent, then C ascertains that B is the traitor and A is 
loyal. Then C will follow the plan vtlac- (lie) If vtlac, 
Iac, and lc are inconsistent, but vtlbc, Ibc, and lc are 
consistent, then A is the traitor. Then, complementary 
to case (he), they will now follow the plan vtlbc- (hf) 
If vtlac, Iac, and lc are inconsistent, and C is receiving 
vase = -L, this means that both C and B know that A 
is the traitor. Then C and B will follow the previously 
decided plan 0. 

The generation and distribution of the lists with prop- 
erties (I), (II), and (III) is achieved by distributing among 
the parties four qubits initially prepared in some spe- 
cific state, then making local single qubit measurements 
on the four qubits, and then testing (using the pairwise 
classical channels) whether or not the results of these 
measurements exhibit the required correlations. 

The state used in our protocol is the four-qubit state 

|* (4) Ucd = ^=(2|0011)-|0101)-|0110)-|1001) 
-11010) + 2|1100)) afccd , (1) 

where, e.g., |0011) a6c(i means |0) a ® |0)& ® |l) c ® \l) d - 
This state has been observed in recent experiments 
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[id lllf . The protocol exploits two properties of this 
state, i.e., the fact that it is invariant under the same 
unitary transformation applied to the four qubits (i.e., 
U <g> U <g> U ® U\^) abcd = |*( 4 )) a6crf ), where U is any 
unitary operation acting on one qubit, and the fact that 
it exhibits the required perfect correlations between the 
results of projection measurements on the four qubits. 
Specifically, if A measures qubits (a) and (b) , B measures 
qubit (c) and C measures qubit (d), and all of them are 
measuring in the same basis, then: if the results of the 
measurements on qubits (a) and (b) are both 1 (which A 
will record as a single 0) — something which occurs with 
probability 1 /3 — , then the result of the measurement on 
qubit (c) must be (which B will record as 0) and the 
result of the measurement on qubit (d) must be (which 
C will record as 0). If the results of the measurements 
on qubits (a) and (b) are both (which A will record as 
a single 1), then the result of the measurement on qubit 
(c) must be 1 (which B will record as 1) and the result 
of the measurement on qubit (d) must be 1 (which C 
will record as 1). Finally, if the results of the measure- 
ments on qubits (a) and (b) are either and 1, or 1 and 
(which A will record as a single 2), then the results of 
the measurements on qubits (c) and (d) can be either 
and 1, or 1 and 0. 

The distribute and test part of the protocol consists of 
the following steps: (i) A source emits a large number 
of four-qubit systems in the state |<3>( 4 )). For each four- 
qubit system j, qubits (a) and (b) are sent to A, qubit (c) 
to B and qubit (d) to C. (ii) For each four-qubit system 
j, each of the three parties randomly chooses between 
two projection measurements; e.g., each of them cither 
measures in the {|0), |1)} basis or in the {|0), |1)} basis 
[where |0) = (|0> + \1))/V2 and |1) = (|0) - |1))/V2| and 
makes a list with his results. To extract the correlated 
fourfold coincidences, they do the following. For the first 
one third of the experiments, C asks A and B whenever 
they have detected and in which bases they have mea- 
sured their qubits (50% of the cases, A speaks first, and 
in the other 50%, it is B who speaks first). Then, C tells 
A and B which events should be rejected. For the sec- 
ond one third of the experiments, B and C exchange their 
roles, and for the last one third, A and B exchange their 
roles. By exchanging the roles, they ensure that none of 
the generals can fake parts of the classical protocol with- 
out being discovered. After this step, each of the parties 
has a list. These lists are all of the same length. A has 
a list I a of trits, and each of B and C has a list, Ib and 
lc respectively, of bits. (Hi) C randomly chooses a posi- 
tion kc from his list lc and asks A and B to inform him, 
via the pairwise classical channels, about their results on 
the same position kc- If all parties have measured in the 
same basis, their results must be suitably correlated. Af- 
ter this step, each party discards the entries in their lists 
which were used for this test, (iv) The parties exchange 
their roles; i.e., B randomly chooses a new position ks 




FIG. 2: Scheme of the experimental setup. UV-pulses pump 
a beta-barium borate crystal BBO. The degenerate down- 
conversion emission into the two directions, ao and 6o, is cou- 
pled into optical fibers by fiber couplers FC, then passes in- 
terference filters F. To generate the state |^ ), the initial 
emission modes are split with two nonpolarizing beam split- 
ters BS. Two of the photons are sent to A, one to B, and one 
to C. Then, each party performs polarization measurements 
by inserting a half-wave plate HWP and using a polarizing 
beam splitter PBS and single-photon avalanche detectors. 



from his list and repeats step (in); then A chooses a new 
position kA, etc. C starts the process all over again until 
a large number of tests have been performed. 

This part of the protocol has only two possible out- 
comes: Depending on the observed quantum error ratio 
(QER) , defined as the ratio of incorrect / all four-photon 
detection events, the loyal generals decide to abort or use 
the lists I a, Ib, and lc to reach the agreement. 

In the experimental implementation, the physical 
qubits are polarized photons, and the states |0) and |1), 
correspond, respectively, to the vertical and horizontal 
linear polarization states, \V) and \H). To prepare the 
state |vE ,( ' 4 ' ) ), we have used the emission of four photons 
produced in the second order of perturbation of the type- 
II process of spontaneous parametric down-conversion 
[11 Id fioj] . The experimental setup is shown in Fig. [21 We 
have used UV-pulses of a frequency doubled mode-locked 
Titan: Sapphire laser (pulse length 130 fs and repetition 
rate 82 MHz) to pump a 2 mm thick beta-barium bo- 
rate (BBO) crystal at a wavelength of 390 nm and with 
an average power of 750 mW. The pump beam has been 
focused to a waist of 100 fim inside the crystal. The 
degenerate down-conversion emission into the two char- 
acteristic type-II crossing directions, ao and bg, has been 
coupled into single mode optical fibers (length 2 m) to 
precisely define the spatial emission modes. After the 
fibers, the down-conversion light has passed interference 
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filters with a bandwidth of 3 nm. To generate the four- 
photon state l^ 4 -*), the initial emission modes have been 
split with two nonpolarizing beam splitters. We have se- 
lected those events in which one photon is detected in 
each of the resulting four outputs (a, b, c, and d) of the 
beam splitters. 

The polarization measurements have been performed 
by inserting half- wave plates in each of the four modes. 
For measuring in the polarization bases {\H), \ V)} and 
{(\H) + \V))/y/2, (\H)-\V))/y/2}, the orientations of the 
half- wave plates have been randomly switched between 0° 
and 22.5° respectively. The switching of the wave plates 
has been controlled by random number generators. The 
registration time for a fixed setting has been 1 s. The 
four photons have been detected, after passing polariz- 
ing beam splitters, by eight passively quenched single- 
photon Si-avalanche photodiodes and registered with an 
eight-channel multiphoton coincidence counter, which al- 
lows an efficient registration of the 16 relevant fourfold 
coincidences 
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When more than one four-photon coin- 
cidence has been recorded in the same time window, only 
the first one has been used. To translate the detection 
events into bit values, we have associated a single-photon 
detection in the reflected (transmitted) output port of 
the polarization beam splitters with the bit value (1). 
All the detection events and the basis settings have been 
registered with a personal computer. 

To generate the lists, the parties have performed 48184 
measurements in 17 hours. To extract the fourfold coin- 
cidences in each time window, each party has asked the 
other parties whenever they detected a photon. After 
removing those entries where they have not registered a 
photon, they have obtained lists Ia, Ib and lc with 12043 
entries containing 3000 correlated bits/trits with a QER 
of 5.47%. For the first part of the protocol, each of the 
parties has randomly chosen 1000 entries from his list. 
To check whether their results are perfectly correlated or 
not, each party has computed the QER for those entries 
which should be perfectly correlated from his subset. A 
has obtained a QER of 3.32%, B 4.64%, and C 5.40% 
(the QERs depend on the randomly chosen subsets) . For 
the second part of the protocol, the parties have used 
the remaining correlated entries of their lists. A subset 
of these lists is shown in Table |U 

In conclusion, we have introduced a new quantum pro- 
tocol for solving a fundamental problem in fault-tolerant 
distributed computation and database replication. Our 
protocol uses simpler lists or uses them more efficiently 
than previous protocols, and permits the simultaneous 
generation of all the lists. In addition, we have presented 
the first experimental demonstration of a quantum pro- 
tocol for DBA and liar detection via four-qubit entangle- 
ment. Although the same problems could be solved by 
linking several quantum key distribution protocols, our 



results show that a more specific and elegant quantum 
solution requiring a subtler form of entanglement is fea- 

TABLE I: Part of the lists I a, Ib, and lc obtained experimen- 
tally. Numbers in italics are events which should not occur in 
an ideal case. 
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sible with present technology. 
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